CVE-2026-53958

Full vulnerability record from the local CVENow database.

Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9.

Severity

HIGH

CVSS score

7.6 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-08-18 22:16:54.717000

Last modified

2026-10-22 17:09:59.477000

View original CVE JSON

{
  "id": "CVE-2026-53958",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T22:16:54.717",
  "lastModified": "2026-10-22T17:09:59.477",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9."
    },
    {
      "lang": "es",
      "value": "4gaBoards es un sistema de tableros para la gestión de proyectos en tiempo real. Antes de la versión 3.3.9, 4gaBoards permite a un usuario autenticado modificar ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId y ssoOidcEmail a través de PATCH /API/users/:id. La lista blanca en server/api/controllers/users/update.js asigna masivamente estos atributos de identidad gestionados por el backend a partir de la entrada del usuario. Un atacante puede colocar el identificador de proveedor de una víctima en una cuenta controlada por el atacante, lo que hace que la búsqueda predeterminada en ayudantes como server/api/helpers/users/get-create-one-for-github-sso.js coincida con el primer inicio de sesión SSO de la víctima con la cuenta del atacante antes de que se ejecute el flujo de vinculación por correo electrónico. La víctima inicia sesión en la cuenta controlada por el atacante, y los proyectos, tableros o datos que la víctima crea permanecen accesibles a través de las credenciales locales originales del atacante. Este problema se soluciona en la versión 3.3.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "RARgames",
          "product": "4gaBoards",
          "versions": [
            {
              "version": "< 3.3.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T16:11:43.992653Z",
          "id": "CVE-2026-53958",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/RARgames/4gaBoards/commit/7a79f4c5d338614058515752abd67e49ee2818bb",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RARgames/4gaBoards/releases/tag/v3.3.9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/RARgames/4gaBoards/security/advisories/GHSA-j2fw-r2gj-hfr3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}